Configuring Openbsd as a home router -- the missing piece

Setting up Openbsd as a router is really easy and the documentation at Openbsd.com was really good except there was a missing piece of information that eluded me and therefore i spent hours and hours searching and finally i was able to setup the box as a Openbsd Router..
Maybe i don't know how to read the FAQ but it was not clearly given.
(scroll to the end to find what i was missing .. Once i did that it worked like
a charm)

My OpenBsd box
 - Pentium dual core - Dell optiplex 755 small factor
 - 2 Gigabit ethernet nics - one built in and other a PCI card
 - 160 GB Hard drive
 - 4Gb memory

Openbsd 5.6


$ ifconfig -a
lo0: flags=8049 mtu 32768
        priority: 0
        groups: lo
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4
        inet 127.0.0.1 netmask 0xff000000
em0: flags=28843 mtu 1500
        lladdr 00:1a:a0:7e:df:b7
        priority: 0
        groups: egress
        media: Ethernet autoselect (1000baseT full-duplex,master,rxpause,txpause)
        status: active
        inet 192.168.1.2 netmask 0xffffff00 broadcast 192.168.1.255
re0: flags=28843 mtu 1500
        lladdr 00:e0:4c:69:1b:d9
        priority: 0
        media: Ethernet autoselect (1000baseT full-duplex,master)
        status: active
        inet 10.0.0.1 netmask 0xffffff00 broadcast 10.0.0.255
enc0: flags=20000
        priority: 0
        groups: enc
        status: active
pflog0: flags=20141 mtu 33144
        priority: 0
        groups: pflog
$


Here em0 is the internet facing nic and re0 is the internal lan facing nic

My configuration files:

/etc/dhcpd.conf

   option domain-name-servers 10.0.0.1 , 68.238.64.12;
   subnet 10.0.0.0 netmask 255.255.255.0 {
       option routers 10.0.0.1;
       range 10.0.0.2 10.0.0.128;
       host server {
           fixed-address 10.0.0.21;
           hardware ethernet 00:25:64:EE:DD:52;
      }
}




$ cat rc.conf.local
dhcpd_flags="re0"
$

$ cat sysctl.conf                                                                      
net.inet.ip.forwarding=1
$

$ cat hostname.re0
inet 10.0.0.1 255.255.255.0 NONE 
$ cat hostname.em0                                                                     
dhcp
$

$ cat resolv.conf                                                                      
# Generated by em0 dhclient
search home
nameserver 192.168.1.1
lookup file bind
$

/etc/mygate file does not exist.. (was not created during the install.. nor i created it later at any point)

resolv.conf is automatically created during the OpenBSD install when u
setup the dhcp on the em0 interface.

This is all that has to be done per documentation and Openbsd should work as a router..
The problem is the clients are able to get the dhcp information and are able to ping the lan nic but cannot connect to internet. I wondered why.. sysctl.conf was configured correctly to set the box as a  forwarding gateway.

I disabled PF and still could not connect to the internet. Enabling or disabling PF had no effect.

The missing piece :
Thanks to bsd now "Episode 011: The Gateway Drug" video it showed how to correctly setup a openbsd router.
What I was not getting was that a pf.conf entry and that PF should be setup for firewall.

The pf.conf entry that did the trick was

pass out on em0 inet from re0:network to any nat-to em0

pass out on em0 inet from re0:network to any nat-to em0
(ie setup NAT i suppose)..

so problem solved. Now i could connect to internet. I used the default pf.conf that came with the install and just added this entry.

pf.conf below:
# cat pf.conf
#       $OpenBSD: pf.conf,v 1.53 2014/01/25 10:28:36 dtucker Exp $
#
# See pf.conf(5) for syntax and examples.
# Remember to set net.inet.ip.forwarding=1 and/or net.inet6.ip6.forwarding=1
# in /etc/sysctl.conf if packets are to be forwarded between interfaces.

# increase default state limit from 10'000 states on busy systems
#set limit states 100000

set skip on lo

# filter rules and anchor for ftp-proxy(8)
#anchor "ftp-proxy/*"
#pass in quick inet proto tcp to port ftp divert-to 127.0.0.1 port 8021

# anchor for relayd(8)
#anchor "relayd/*"

block return    # block stateless traffic
pass            # establish keep-state

# rules for spamd(8)
#table persist
#table persist file "/etc/mail/nospamd"
#pass in on egress proto tcp from any to any port smtp \
#    rdr-to 127.0.0.1 port spamd
#pass in on egress proto tcp from to any port smtp
#pass in log on egress proto tcp from to any port smtp
#pass out log on egress proto tcp to any port smtp

pass out on em0 inet from re0:network to any nat-to em0

#block in quick from urpf-failed to any # use with care

# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010
#


Next I need to learn PF so that i understand what each line above is doing and much more...